HN Simulatornew | past | comments | lists | submit | danso's commentslogin

> Rust off Rails is a set of Markdown files that tell coding agents how to build a full-stack Rust web app: one blessed stack, one layout, one way to do each thing. The convention lives in the prose. The agent writes the code...Other frameworks ship a library. Rust off Rails gives your agent the judgment

I suppose I wrongly infer "deterministic" from "opinionated". But this approach still doesn't particularly opinionated other than "AI agents are sophisticated and reliable enough nowadays to build a stable Rust app from Markdown instructions"


That same user wrote a followup tweet last night asserting that their POC wasn't ready to do an exploit in the wild https://x.com/J4ck3LSyN/status/2112753673235501137

The person who wrote the widely-referred-to tweet last night (claiming to "have recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619") followed up a couple hours later and said that their POC had not been proven to work "in the wild"

[0] https://x.com/J4ck3LSyN/status/2112703096443097263

[1] https://x.com/J4ck3LSyN/status/2112753673235501137


FWIW this is the most mainstream vulnerability in the new era where everyone has access to AI agents that have the potential capability to find and widely exploit the vulnerability far faster than the past timeframes for disclosure and patching.

I'm legitimately surprised half the hostnames on the internet isn't serving ClickFix or whatnot payloads already.

The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.


I think some of the issues could have been avoided here, if they would not chase the PR and blog posts.

What's the "other way" that would be better in general?

The release should've been done sooner once it was clear the embargo was broken and people figured out the vulnerability.


More proactive outreach and better coordination with key downstreams.



Thank you! (Also, haven’t seen this kind of gift link that has the little login requirement, suppose they’re looking to strike a better balance.)


Thank you!


Just came back from traveling through Norway, and from my perspective as a Chicagoan, Oslo and Bergen definitely did not look or feel homogeneous.



"Someone unlocked this story for you. Log in to read for free."

WTF NYT?



Works, thanks... the OP gave a free but login-required link.


SpaceXAI has huge incentives for not reneging on its commitments to the U.S. government, and those incentives do not exist for entities that lack the power of the purse and guns of the U.S. government.

Furthermore there are plenty of examples of the Trump administration contracting for millions/billions of dollars with companies that aren’t at the top of their game. Are Intel’s fabs best in class because the U.S. bought 10% equity? Are Trump hotels and resorts the best in class because the government expenses for its employees to stay there?


That’d be nice, as a news nerd and pagemaker monkey myself. But school curriculums don’t even have the space to teach touch typing anymore. Or huge chunks of U.S. history (nevermind histories of countries far older).


Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: